The KeyCAPTCHA WordPress plugin has a Cross‑Site Request Forgery flaw that allows an attacker to inject and store malicious JavaScript. When a CSRF request is processed, the plugin accepts unsanitized input and stores it as part of its configuration, creating a stored XSS condition. An attacker who can trigger the request – typically by luring a logged‑in user – can cause the stored script to run in any visitor’s browser, compromising site confidentiality and integrity. This weakness is represented by CWE-352 for CSRF.

WordPress sites running the KeyCAPTCHA plugin from the vendor KeyCAPTCHA, versions 2.5.1 and earlier are affected. No additional version information is provided.

The CVSS score of 7.1 denotes a medium‑high risk severity. The EPSS score of less than 1% suggests a low probability of exploitation in the near term, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves a crafted URL or phishing link that a logged‑in user accesses, triggering a CSRF request that injects malicious payload into the plugin’s stored data. After the payload is stored, any visitor to the affected content will execute the script, enabling data theft or site defacement.